For Eathlink/Mindspring subscribers: FRAUD ALERT

21 Dec 03 | King Prout

[King Prout]

Everyone,

Yesterday I received an e-mail, supposedly from Earthlink Billing, supposedly about problems with my account. I found it suspicious. It had an attachment, which I did not open. It contained a link, to a webpage which caused all sorts of security warnings to pop up on my screen. I contacted Earthlink. They say this is a fraudulent message. I figure y'all might find a warning useful.

EMAIL "FROM" CONTENT:
Earthlink.net

EMAIL SUBJECT CONTENT:
Problems with your Earthlink account

EMAIL BODY TEXT:
Dear Earthlink valued customer,

We regret to inform you, that we were unable to charge your card. This maybe due to our payment processing failure, billing system overload, invalid card number, exp date, daily limit, insufficient funds, or other reasons. We need you to re-enter valid payment and verification information.

Click here to continue payment verification process - https://earthlink.net/payment/verification.cgi
Your information will be submitted via a secure server.
Earthlink keeps all of your contact and billing information confidential and private.

"PROPERTIES" > DETAILS:
Status: U
Return-Path: < Shakoor_Berna@cis.net >
Received: from pacbell.net ([67.127.158.114])
by wanamaker.mail.atl.earthlink.net (EarthLink SMTP Server) with SMTP id 1axLwK6sA3Nl3oJ0
for < KP's email >; Sat, 20 Dec 2003 13:08:30 -0500 (EST)
Received: from adsl-67-127-158-114.dsl.sndg02.pacbell.net (adsl-67-127-158-114.dsl.sndg02.pacbell.net [67.127.158.114])
by pacbell.net (8.12.8p1/8.12.8) with ESMTP id oiqnzj93231
for < KP's email >; Sat, 20 Dec 2003 18:08:06 -0400 (EST)
Date: Sat, 20 Dec 2003 18:08:04 -0400 (EST)
From: Earthlink.net < account_verification982@cis.net >
X-Mailer: The Bat! (v1.61) Personal
Reply-To: Shakoor_Berna@cis.net
X-Priority: 3 (Normal)
Message-ID: < 829150686.10469538682127@cis.net >
To: KP's email
Subject: Problems with your Earthlink account.
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------508468659176133"
X-SpamPal: PASS

I would strongly suggest all Earthlink customers to add the following to whatever email blacklists you use:

Shakoor_Berna@cis.net
account_verification982@cis.net

[King Prout]

I would strongly suggest all Earthlink customers to add the following to whatever email blacklists you use:

Shakoor_Berna@cis.net
account_verification982@cis.net

[Glenn]

There is a well-known exploit to redirect your IE browser to an unofficial website but allow it to appear as the actual website you might think it should be in the address bar. Microsoft patches lag. Third party patch is available.

[Overtaxed]

Yeah, I got one too but from a different address. Thought about telling them to go ahead and drop my account. :)

[King Prout]

institutional suspicion and recordkeeping trumps all of the above. :)

[madprof98]

It looks very real. My wife depends on Earthlink for her work, so we got on it immediately. Fortunately, we called and found they had a recorded message about this particular fraud.

[EggsAckley]

I got the same earthlink fraud a few months ago. I immediately contacted earthlink, and they wrote back that they had "taken action" after receiving my email.

They pointed out that we should remind everyone that earthlink does NOT request such information via email.

Heads up; the scum is at it again.

[Jalapeno]

There's a good one for PAY PAL floating around. They send you a mail with a supposed link to Pay Pal wanting you to login to pay pal and update your CC info, when it really is a spoof site.

Bad stuff for those too lazy to make sure what they click on is really taking them where they think they are going.

Always be suspicious when asked for passwords, CC #'s, birthdates, social security numbers, etc.

[King Prout]

oh, it looks real enough, but...
1. earthlink does not request such info via email
2. the email is chock full of typos and grammatical errors
3. recordkeeping of valid invoice statements ensures the user KNOWS whether the account is paid up or not
4. no one should ever -EVER- open an unexpected attachment
5. "Earthlink.net" is not the same as "invoice.inquiry@earthlink.net" - again: recordkeeping and suspicion as institutions!!!

when it comes to the net, paranoia is a virtue.

[King Prout]

PayPal has been hammered by the fraud artists.
I cancelled my PayPal account as a result.
Now, ANY communication I get purporting to be from PayPal is automatically circular-filed and the source code gets added to my blacklists.

[countrydummy]

OOOOOOOHHH! Thanks! Recently switched over to Earthlink, because they bought my other provider. I might have feel for this one is not for your thread!

[EggsAckley]

O.M.G.!!
I just received the same fraud in my earthlink Spamblocker! LOL!

[King Prout]

burn this into your memory, since this has happened before and will happen again:
EARTHLINK DOES NOT REQUEST CREDIT-CARD INFORMATION BY EMAIL

also:
BLACKLIST AND DELETE ANY EMAIL FROM ANY SOURCE WHICH REQUESTS PERSONL ID OR FINANCIAL DATA

[countrydummy]

Thank you, excellent advice!

[Dscott_FR]

I got the same type of email twice from Yahoo. I don't even pay for my yahoo account!

[longtermmemmory]

THANKS!

[King Prout]

glad to be of help.
I just wish I could get my hands on one of these (censored) (censored) fraudulent (censored) spammers for a leisurely month-long chat...

[King Prout]

serendipitous synchronicity is prone to whimsy :)

[Glenn]

Check here to see if your Windoze OS is vulnerable to the madness.

[countrydummy]

LOL I hear ya!!! I have unique torture tools....Lip Rippers! lol lol

[King Prout]

check where?